You can upgrade NGINX without deliberately dropping active connections by running the old and new binary generations together, checking the new generation, then gracefully draining the old workers. The handoff uses three signals: USR2 starts the new master, WINCH drains workers owned by the old master, and QUIT retires that old master.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The sequence is safe only when you keep a rollback copy, validate the replacement binary and modules, identify the correct PID files, and wait for observable health instead of relying on a fixed sleep. Long-lived requests, WebSockets and busy workers can make the drain take an unpredictable amount of time.
As an Amazon Associate I earn from qualifying purchases.
What an in-place NGINX upgrade actually does
An in-place upgrade replaces the executable used by the service while preserving the listening sockets and allowing two process generations to overlap. The existing master and workers continue handling established work while a new master starts from the replacement executable. Both generations can hold the same listening sockets during the transition.
That overlap is why an upgrade can avoid a planned connection drop. New requests can be accepted by the new workers, while old workers finish requests and connections they already own. A graceful shutdown does not forcibly close those sessions; it asks workers to stop accepting new work and exit after active work completes.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
This is not the same as stopping the service and starting it again. A stop/start cycle closes the old process tree and can interrupt clients. The on-the-fly procedure keeps the old generation available until the new one has been tested.
The three signals and their owners
| Signal | Send it to | Effect | When to use it |
|---|---|---|---|
USR2 |
The currently running master | Renames the current PID file to an .oldbin form and starts a new master and new workers from the replacement executable. |
After the replacement file and configuration have been validated. |
WINCH |
The old master PID recorded in the .oldbin file |
Asks the old master to gracefully stop its workers. They stop taking new work and finish active requests. | Only after the new master and its workers are healthy. |
QUIT |
The old master | Gracefully retires the old generation after its workers have drained. | After the overlap has been observed and rollback is no longer immediately needed. |
Do not send QUIT to the new master by mistake. The PID in the original PID file identifies the new generation after USR2; the old master is identified by the .oldbin PID file.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Prepare before changing the live executable
Preparation determines whether the procedure is reversible. Perform these checks while the current service is still healthy.
Record the running state
- Find the master PID file used by this installation. Common locations include
/run/nginx.pidand/var/run/nginx.pid, but the configured path is authoritative. - Save the current executable as a rollback copy. Preserve its ownership, permissions and execution context when storing it.
- Record the current master PID, worker PIDs, executable path, version and compiled modules. The command
nginx -Vdisplays the version and configure arguments for the binary in your shell path; confirm that this is the same installation serving traffic. - Keep the current PID file and be prepared to retain the
.oldbinfile until the upgrade is accepted.
Do not delete the old executable or PID state immediately after the new workers appear. Those artifacts are what make a quick rollback possible.
Build or obtain a compatible replacement
The replacement must support the modules and features used by the live configuration. A configuration that passes syntax parsing can still fail at startup if a dynamic module is missing, built for an incompatible version, or loaded from a path the new binary cannot access.
Place the candidate binary in a temporary location first. Test that exact file, not merely an older nginx command elsewhere on PATH. For example:
Recommended Free Tools
/opt/nginx-candidate/sbin/nginx -t -c /etc/nginx/nginx.confUse the installation’s real binary and configuration paths. The test should report a successful syntax check before you replace the live executable. If your configuration includes relative paths, custom prefixes or dynamic modules, test with the same prefix and module layout used by the service.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Check operational prerequisites
- Ensure you can send signals to the NGINX master as the account that owns the service or with appropriate administrative privileges.
- Confirm that health checks, access logs and error logs are available for observation.
- Identify representative requests, including an endpoint that exercises the important upstreams. If the service carries WebSockets or other long-lived connections, include them in the drain plan.
- Have a clear abort condition: a missing new master, failing health checks, unexpected error-log messages, or a worker that exits repeatedly.
Perform the binary upgrade step by step
1. Install the replacement while preserving rollback
Copy or atomically move the validated replacement into the executable path used by the running service. Keep the old file under a separate rollback name before changing that path. Do not remove the old file while the original master is still running; its process must remain able to finish the handoff.
After installation, verify the file is executable and that its module files and configuration dependencies are present. If the replacement was built on another host, confirm that its runtime libraries and architecture match the target host.
2. Ask the current master to start a second generation
Set a shell variable to the actual PID-file path, then capture the current master PID before sending the signal:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPIDFILE=/run/nginx.pid
OLD_MASTER=$(cat "$PIDFILE")
kill -USR2 "$OLD_MASTER"On a successful handoff, NGINX renames the existing PID file to an .oldbin file and writes a new PID file for the new master. The old workers continue serving while the new master starts its workers.
If the new master cannot start, do not continue to WINCH or QUIT. Investigate the error log and preserve the old generation.
3. Verify the new generation before draining anything
Use the new PID file and process inspection to confirm that a distinct master and its workers exist:
NEW_MASTER=$(cat "$PIDFILE")
OLD_MASTER=$(cat "${PIDFILE}.oldbin")
ps -o pid,ppid,cmd -C nginx
readlink -f "/proc/$NEW_MASTER/exe"The exact process-listing command may differ by operating system. What matters is that the new master PID is different from the old master PID, the new workers are running, and the old master is still present.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Verify all of the following before draining:
- The new master is executing the intended replacement file.
- The expected version and compiled modules are present.
- New workers have started and remain running rather than repeatedly exiting.
- Health checks return the expected status and representative requests reach the correct upstreams.
- Error logs do not show module-load failures, permission errors, bind failures or configuration-dependent runtime errors.
- Both generations still have access to the intended listening sockets.
Make these checks against the live service, not only with a local syntax test. A syntactically valid configuration does not prove that the new binary can serve real traffic.
4. Gracefully drain the old workers
Once the new generation is demonstrably healthy, send WINCH to the old master read from the .oldbin file:
OLD_MASTER=$(cat "${PIDFILE}.oldbin")
kill -WINCH "$OLD_MASTER"This signal is intentionally sent to the old master, not directly to individual workers. The old master tells its workers to shut down gracefully. They stop accepting new work and finish requests and connections already in progress.
Continue observing traffic while the drain proceeds. Check that new requests are being handled by new workers, old worker PIDs are disappearing as they finish, and logs remain clean. A short request may drain quickly; a WebSocket, streaming response, slow upload or long upstream operation can keep an old worker alive much longer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Retire the old master only after the drain
When the new generation is healthy and the old workers have finished, send QUIT to the old master:
OLD_MASTER=$(cat "${PIDFILE}.oldbin")
kill -QUIT "$OLD_MASTER"QUIT is a graceful retirement request. After it completes, only the new master and its workers should remain. Confirm that the old master process and the .oldbin PID state are gone before deleting your rollback copy.
How to decide when the drain is complete
There is no universal number of seconds to sleep between signals. Drain time depends on request duration, keepalive behavior, WebSockets, worker load and host scheduling. A fixed delay can be too short for a long-lived connection and unnecessarily long for an idle service.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Automation should wait for state, not time:
- Wait until the new master PID exists and its workers remain present.
- Run health checks and representative requests repeatedly during the overlap.
- After
WINCH, wait until old worker processes have exited or until your documented long-lived-connection policy says they may be terminated separately. - Only then send
QUITto the old master. - After retirement, verify that the service still answers requests and that no old-generation process remains.
Record signal times, process states and health-check results in deployment logs. This gives you evidence that the handoff completed rather than merely assuming that it did.
Rollback if the replacement is faulty
Keep the old executable and the .oldbin PID file until acceptance is complete. Rollback is simplest while the old master is still available.
If the new master starts but fails health checks
NGINX documents sending HUP to the old master to start old workers again without rereading the configuration. Use the PID in the .oldbin file:
OLD_MASTER=$(cat "${PIDFILE}.oldbin")
kill -HUP "$OLD_MASTER"Confirm that old workers return and successfully handle health checks. Then gracefully shut down the new master, using the PID in the current PID file, not the .oldbin PID:
NEW_MASTER=$(cat "$PIDFILE")
kill -QUIT "$NEW_MASTER"Follow your platform’s documented recovery procedure if the new master is not responding to a graceful signal. In some failures, terminating the new master allows the old master to resume workers. Do not remove the old binary until the old generation is serving normally.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If the new master never starts
The old generation should continue serving. Inspect the error log for an executable, module, permission, library or configuration-path failure. Restore the previous executable if necessary, rerun the replacement binary’s configuration test, and do not send WINCH or QUIT to the old master until a new generation can be verified.
Rollback boundaries
- Before
WINCH, both generations are available and rollback is generally least disruptive. - After old workers have drained, rollback requires bringing them back with the old master and stopping the new generation.
- After deleting the old executable or
.oldbinstate, the fast rollback path is gone. Retain those files until monitoring and acceptance criteria are complete.
Manual binary replacement versus a package-managed NGINX Plus upgrade
A manual on-the-fly binary upgrade exposes the signal choreography directly. A package-managed NGINX Plus upgrade adds repository, credential, package and release-management steps. They should be treated as separate runbooks even though both require validation and post-upgrade observation.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Concern | Manual binary replacement | Package-managed NGINX Plus upgrade |
|---|---|---|
| Rollback control | You explicitly retain the old executable, old master and .oldbin PID state, then choose when to drain and retire them. |
Use the package manager’s installed-version and downgrade capabilities together with the vendor’s documented procedure; retain configuration and logs. |
| Repository and licensing | Requires a compatible binary and any separately managed modules; no repository step is inherent to the signal sequence. | Requires the official repository configuration and the credentials or entitlements required for the installation. |
| Compatibility | You are responsible for matching compiled modules, dynamic modules, libraries and configuration behavior. | Check the package’s supported upgrade path and the release notes for source- and target-version changes. |
| Backups | At minimum, preserve the old executable and PID state; configuration and logs should also be retained for recovery. | Back up /etc/nginx and logs before using the operating system’s package manager. |
| Automation | Automate signal delivery and wait for observable PIDs, workers, health checks and drain completion. | Automate repository/package steps only where your distribution and vendor runbook support them, then perform the same version and configuration verification. |
| Operational support | Provides direct control over overlap, draining and rollback, but leaves more responsibility with the operator. | Provides vendor release notes and package integration, but version-specific changes may require additional actions. |
Safe package-upgrade sequence
- Configure the official NGINX Plus repository and verify the required credentials.
- Back up
/etc/nginx, logs and any local module or certificate material needed to restore service. - Read the release notes for the exact source and target releases, including configuration or module changes.
- Use the operating system’s package manager to install the target release according to the vendor runbook.
- Verify the installed version, run
nginx -t, and check that the service starts with the expected modules. - Exercise health checks and representative traffic, then monitor logs and worker stability.
Do not assume that a package upgrade has identical signal behavior to a hand-copied binary replacement. Follow the package and vendor instructions for your distribution, while retaining the same principle: validate first, observe the new generation, and keep a recovery path until acceptance.
Troubleshooting common failure modes
No new master appears after USR2
Check the error log immediately, verify that the executable at the service path is the intended file, and run that file with -t against the live configuration. Missing dynamic modules, incompatible libraries, permissions and invalid paths are common causes. Leave the old generation untouched while correcting the candidate.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe .oldbin PID file is missing
Confirm the configured PID-file location and inspect the directory for a differently named PID file. A service wrapper may use a non-default path. Do not guess an old PID from a process listing and signal it until you have confirmed that it is the original master.
Workers start and then exit
Compare the new binary’s version and compiled modules with the old installation. Inspect error logs for module-load errors, upstream initialization failures and permission problems. A passing syntax test cannot detect every runtime dependency.
Clients still report connection failures
First verify that you did not send a signal to the wrong generation. Confirm that the new workers have listening sockets, then inspect health checks, error logs and upstream availability. If failures began after WINCH, stop the drain by restoring old workers with HUP while you investigate.
Old workers do not disappear
Look for long-lived requests, WebSockets, slow clients, keepalive sessions or blocked upstream operations. Do not use a fixed short timeout as proof that draining failed. Identify the specific worker and connection, wait according to your service policy, and only use a forced termination procedure when the risk of leaving it alive is understood.
The wrong master was retired
Re-read both PID files and compare their parent-child process trees. The original master is represented by the .oldbin PID after USR2; the current PID file belongs to the new master. If the new generation was stopped accidentally, restore service using the retained old executable and the documented rollback sequence.
Automation principles for repeatable upgrades
A deployment script should treat the upgrade as a state machine rather than a list of timed shell commands. Record the old master PID, replacement path, new master PID and old master PID separately. Make each signal operation explicit in logs.
- Abort if the candidate binary’s configuration test fails.
- Abort if the PID file does not identify a running master before
USR2. - After
USR2, require a new master and stable workers before proceeding. - Run active health checks during the overlap and define what constitutes failure.
- After
WINCH, wait for old workers to exit instead of sleeping for a guessed interval. - Send
QUITonly to the verified old-master PID. - Retain the old executable and rollback state until the monitoring window ends.
- Make the process safe to stop and resume if an operator intervenes between signals.
This approach also makes an interrupted deployment diagnosable: the recorded state tells you whether the system is before the handoff, between generations, draining old workers or fully upgraded.
Quick Recap
Final verification checklist
- The intended new version and modules are running.
- Only the new master and workers remain after retirement.
- Health checks and representative requests succeed.
- Error logs show no upgrade-related failures.
- Long-lived connections were allowed to complete according to policy.
- The old executable and rollback records are retained for the agreed acceptance period.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
